GHSA-2969-8hh9-57jc

Allocation of Resources Without Limits or Throttling in ckb

Source: GitHub Advisory Database (reviewed) High CVE-2021-45699

Packages

Ecosystem	Package	Affected	Fixed in
crates.io	ckb	< 0.40.0	0.40.0

Details

As written in the advisory (Markdown source, shown as plain text).

An issue was discovered in the ckb crate before 0.40.0 for Rust. Remote attackers may be able to conduct a 51% attack against the Nervos CKB blockchain by triggering an inability to allocate memory for the misbehavior HashMap.

References

External links from the advisory. They lead to third-party sites.

https://github.com/nervosnetwork/ckb/security/advisories/GHSA-48vq-8jqv-gm6f web
https://nvd.nist.gov/vuln/detail/CVE-2021-45699 advisory
https://github.com/nervosnetwork/ckb package
https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/ckb/RUSTSEC-2021-0108.md web
https://rustsec.org/advisories/RUSTSEC-2021-0108.html web